<?php
declare(strict_types=1);

namespace WebCalendar\WP\Bridge;

defined( 'ABSPATH' ) || exit;

use WebCalendar\Core\Application\Contract\AuthServiceInterface;

/**
 * WordPress implementation of the AuthServiceInterface.
 */
class WpAuthService implements AuthServiceInterface {

	/**
	 * Validates user credentials using WordPress authentication.
	 *
	 * @param string $username Username.
	 * @param string $password Password.
	 * @return bool
	 */
	public function authenticate( string $username, string $password ): bool {
		$user = wp_authenticate( $username, $password );
		return ! is_wp_error( $user );
	}

	/**
	 * Verifies a pre-hashed password.
	 *
	 * @param string $username Username.
	 * @param string $hash Password hash.
	 * @return bool
	 */
	public function verifyHash( string $username, string $hash ): bool {
		$user = get_user_by( 'login', $username );
		// Use a dummy hash to prevent timing attacks if user is not found.
		// WordPress MD5 hashes start with $P$, length is usually 34 chars.
		$actual_hash = $user ? $user->user_pass : '$P$B999999999999999999999999999999';

		$result = hash_equals( $actual_hash, $hash );

		return $user && $result;
	}
}